Section 1. Amend Title 6, Delaware Code by adding a new
Chapter 22 to read as follows:
“Chapter
22. Credit and Identity Theft
Protection.
§2201. Short
Title.
This Chapter shall be known as the ‘Clean Credit and
Identity Theft Prevention Act.’
§2202.
Definitions.
For the
purposes of this Chapter, the following terms shall have the following
meanings:
(1) The term ‘person’ means any individual,
partnership, corporation, trust, estate, cooperative, association, government
or governmental subdivision or agency, or other entity.
(2) ‘Consumer’ means an individual who is a
resident of Delaware.
(3) ‘Consumer reporting agency’ means any person
which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly
engages in whole or in part in the practice of assembling or evaluating
consumer credit information or other information on consumers for the purpose
of furnishing consumer reports to third parties.
(4) ‘Consumer report’ or ‘credit report’ means
any written, oral, or other communication of any information by a consumer
reporting agency bearing on a consumer's credit worthiness, credit standing, credit
score, credit capacity, character, general reputation, personal
characteristics, or mode of living which is used or expected to be used or
collected in whole or in part for the purpose of serving as a factor in
establishing the consumer's eligibility for:
a.
credit
or insurance to be used primarily for personal, family, or household purposes,
except that nothing in this Chapter authorizes the use of credit evaluations,
credit scoring or insurance scoring in the underwriting of personal lines of
property or casualty insurance;
b.
employment purposes; or
c.
any other purpose authorized under section 15 U.S.C. §
1681b.
§2203. Security Freeze.
(a) Definitions. For the purposes of this section, the
following terms shall have the following meanings:
(1) ‘Security freeze’ means a notice, at the
request of the consumer and subject to certain exceptions, that prohibits the
consumer reporting agency from releasing all or any part of the consumer’s
credit report or any information derived from it without the express
authorization of the consumer. If a
security freeze is in place, such a report or information may not be released
to a third party without prior express authorization from the consumer. This
Chapter does not prevent a consumer reporting agency from advising a third
party that a security freeze is in effect with respect to the consumer’s credit
report.
(2) ‘Reviewing the account’ or ‘account review’
includes activities related to account maintenance, monitoring, credit line
increases, and account upgrades and enhancements.
(b) Security Freeze: Timing, Covered Entities, Cost.
(1) A consumer may elect to place a ‘security
freeze’ on his or her credit report by making a request by certified mail or,
through a secure electronic mail method when such method is made available. By January
31, 2009, consumer reporting agencies shall make available a secure
electronic mail method of requesting a security freeze.
(2) A consumer reporting agency shall place a
security freeze on a consumer’s credit report no later than five business days
after receiving a consumer’s request.
Within one year of this Act’s effective date, a consumer reporting
agency shall place a security freeze on a consumer’s credit report no later
than 3 business days after receiving a request from a consumer. Within two years of this Act’s effective
date, a consumer reporting agency shall place a security freeze on a consumer’s
credit report no later than one business day after receiving such a request.
(3)
The consumer reporting agency shall send a written confirmation of the
security freeze to the consumer within five business
days of placing the freeze and at the same time shall provide the consumer with
a unique personal identification number or password to be used
by the consumer when providing authorization for the release of his or her
credit for a specific period of time, or when permanently lifting the
freeze. Within one year of this Act’s
effective date, the consumer reporting agency shall send such a written
confirmation and unique personal identification number or password to the
consumer no later than one business day after
placing the freeze.
(4)
If the consumer wishes to allow his or her credit report to be accessed
for a specific period of time while a freeze is in place, he or she shall
contact the consumer reporting agency, at a point of contact made available by
the agency to receive requests such as via telephone, U. S. mail, certified
mail, overnight mail, or secure electronic mail, with a request that the freeze
be temporarily lifted, and provide the following:
a. proper
identification,
b. the unique personal identification
number or password provided by the consumer reporting agency pursuant to
paragraph (3) of subsection (b), and
c. the time period for which the report shall be
available to users of the credit report..
(5) A consumer reporting agency that receives a
request from a consumer to temporarily lift a freeze on a credit report
pursuant to paragraph (4) of subsection (b) of this section shall comply with
the request no later than three business days after receiving the request. By no later than January 31, 2009, a consumer reporting agency
shall honor such a request made by electronic mail or by telephone within
fifteen minutes of receiving the request.
(6)
A consumer reporting agency shall develop procedures involving the use
of telephone, or upon the consent of the consumer in the manner required by the
Electronic Signatures in Global and National Commerce Act [E-Sign] for legally
required notices, by the Internet, e-mail, or other electronic media to receive
and process a request from a consumer to temporarily lift a freeze on a credit
report pursuant to paragraph (4) of subsection (b) in an expedited manner.
(7) A consumer reporting agency shall remove or
temporarily lift a freeze placed on a consumer’s credit report only in the
following cases:
a.
upon consumer request, pursuant to
paragraph (4) or paragraph (10) of subsection (b);
b. if the consumer’s credit
report was frozen due to a material misrepresentation of fact by the
consumer. If a consumer reporting agency
intends to remove a freeze upon a consumer’s credit report pursuant to this
paragraph, the consumer reporting agency shall notify the consumer in writing
five business days prior to removing the
freeze on the consumer’s credit report.
(8) If a third party requests
access to a consumer credit report on which a security freeze is in effect, and
this request is in connection with an application for credit or any other use,
and the consumer does not allow his or her credit report to be accessed for
that specific period of time, the third party may treat the application as
incomplete.
(9) A security freeze shall remain in place until
the consumer requests that the security freeze be removed. A consumer reporting
agency shall remove a security freeze within three business
days of receiving a request for removal from the consumer, who provides both of
the following:
a. proper
identification, and
b. the
unique personal identification number or password provided by the consumer
reporting agency pursuant to paragraph (3) of subsection (b).
Not later than January 31, 2009, a consumer reporting agency shall remove
a security freeze within one business day after receiving such a request.
(10)
A consumer reporting agency shall require proper identification of the
person making a request to place or remove a security freeze.
(11)
A consumer reporting agency may not suggest or otherwise state or imply
to a third party that the consumer’s security freeze reflects a negative credit
score, history, report or rating.
(12)
The provisions of this section do not apply to the use
of a consumer credit report by any of the following:
a. a
person, or the person's subsidiary, affiliate, agent, or assignee with which
the consumer has or, prior to assignment, had an account, contract, or debtor-creditor
relationship for the purposes of reviewing the account or collecting the
financial obligation owing for the account, contract, or debt.
b. a
subsidiary, affiliate, agent, assignee, or prospective assignee of a person to
whom access has been granted under paragraph (4) of subsection (b) for purposes
of facilitating the extension of credit or other permissible use.
c. any
person or entity acting pursuant to a court order, warrant, or subpoena.
d. a
State or local agency which administers a program for establishing and
enforcing child support obligations.
e. the
Department of Justice, law enforcement agencies, and the Department of Health
and Social Services and their agents or assigns acting to investigate
fraud.
f.
the State Division of Revenue or its agents or
assigns acting to investigate or collect delinquent taxes or unpaid court
orders or to fulfill any of its other statutory responsibilities.
g. a
person or entity for the purposes of prescreening or postscreening as permitted
by the Federal Fair Credit Reporting Act.
h. any
person or entity administering a credit file monitoring subscription service to
which the consumer has subscribed.
i.
any person or entity for the purpose of
providing a consumer with a copy of his or her credit report upon the
consumer’s request.
j.
any property and casualty insurance company for
use only in setting or adjusting a rate or underwriting for property and
casualty insurance purposes.
(13) A consumer reporting agency may charge a
consumer for a security freeze service only in the following discrete
circumstances: (i) $20.00 for the initial
application for the consumer’s first personal identification number or password
and (ii)
if the consumer fails to retain the original personal identification
number or password provided by the agency, the consumer may not be charged for
a one-time reissue of the same or a new personal identification number or
password; however, the consumer may be charged no more than $20.00 for
subsequent instances of loss and reissuance of a new personal identification
number or password. Notwithstanding the
forgoing, no consumer who has been a victim of identity theft shall be charged
any fee for placement of a security freeze on his or her report.
(c) Notice of Rights. At any time
that a consumer is required to receive a summary of rights required under
Section 609 of the Federal Fair Credit Reporting Act, the following notice
shall be included:
Delaware
Consumers Have the Right to Obtain a Security Freeze.
You may obtain a security freeze on your credit report
for no more than $20.00 to protect your privacy and ensure that credit is not
granted in your name without your knowledge. You have a right to place a
‘security freeze’ on your credit report pursuant to Delaware
law. The security freeze will prohibit a
consumer reporting agency from releasing any information in your credit report
without your express authorization or approval.
You must separately request, by certified mail, that it be frozen by the
three consumer reporting agencies and pay each a $20.00 fee to do so. After January 31, 2009, you will be able to request
this freeze from the agencies by e-mail.
The security freeze is designed to prevent credit,
loans, and services from being approved in your name without your
consent. When you place a security freeze on your credit report, you will
be sent a personal identification number or password to use
if you choose to remove the freeze on your credit report or to temporarily
authorize the release of your credit report for a specific period of time after
the freeze is in place. To provide that authorization, you must
contact the consumer reporting agency and provide all of the following:
1.
The unique personal identification number or
password provided by the consumer reporting agency.
2.
Proper identification to verify your identity.
3.
The proper information regarding the period of time
for which the report shall be available to users
of the credit report.
4.
A consumer reporting agency that receives a request
from a consumer to lift temporarily a freeze on a credit report shall comply
with the request no later than three business
days after receiving the request By January
31, 2009, the consumer reporting agency must
temporarily lift the freeze within 15 minutes of receiving the request.
A security
freeze does not apply to circumstances where you have an existing account
relationship and a copy of your report is requested by your existing creditor
or its agents or affiliates for certain types of account review, collection,
fraud control or similar activities.
If you are
actively seeking a new credit, loan, utility, telephone, or insurance account,
you should understand that the procedures involved in lifting a security freeze
may slow your own applications for credit. You should plan ahead and lift a freeze
with enough advance notice before you apply for new credit for the lifting to
take effect. Until January 31, 2009, you
should lift the freeze at least 3 business
days before applying, and after that date you should lift the freeze at least
15 minutes before applying for a new account.
You have a
right to bring a civil action against someone who violates your rights under
the credit reporting laws. The action
can be brought against a consumer reporting agency or a user
of your credit report.”
(d) Violations; Penalties.
If a consumer
reporting agency erroneously, whether by accident or design, violates the
security freeze by releasing credit information that has been placed under a
security freeze, the affected consumer is entitled to:
(1) Notification within five business days of the
release of the information, including specificity as to the information
released and the third party recipient of the information.
(2) File a complaint with the Federal Trade
Commission.
(3) In a civil action against the consumer
reporting agency recover:
a. injunctive relief to prevent or restrain
further violation of the security freeze, and/or
b. a
civil penalty in an amount not to exceed $1,000 for each violation plus any
damages available under other civil laws, and
c. reasonable
expenses, court costs, investigative costs, and attorney’s fees.
(4) Each violation of the security freeze shall
be counted as a separate incident for purposes of imposing penalties under this section.
§2204.
Right to File
a Police Report Regarding Identity Theft
(a)
A person who knows or reasonably believes that he or she has been the
victim of identity theft may contact the police agency that has jurisdiction
over his or her actual residence, which shall take a police report of the
matter, and provide the complainant with a copy of that report. Notwithstanding
the fact that jurisdiction may lie elsewhere for investigation and prosecution
of a crime of identity theft, the local law enforcement agency shall take the complaint and provide the complainant with a
copy of the complaint and may refer the complaint to a law enforcement agency in
that different jurisdiction.
(b) Nothing in this section interferes with the
discretion of a police department to allocate resources for investigations of
crimes. A complaint filed under this section is not required to be counted as
an open case for purposes such as compiling open case statistics.”
Section 2. The Bank Commissioner, 24 months after
enactment, shall deliver to the Governor, President Pro Tempore of the Senate
and the Speaker of the House, a report outlining (1) the feasibility of the
requirement for temporarily removing a consumer’s request for a credit freeze
within 15 minutes, and on the industry’s progress and efforts toward progress,
on meeting this requirement, and (2) the feasibility of developing a secure
electronic mail method of requesting a security freeze, and the industry’s
progress and effort toward meeting the requirements.
Section 3. Severability Clause. The provisions of this Act are
severable. If any phrase, clause,
sentence, provision or section is declared to be invalid or preempted, in whole
or in part, by federal law or regulation, the validity of the remainder of this
Act shall not be affected thereby.
